From 0669c31b52fa6b6be656d812186bb1854d6e123a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E5=8C=97=E4=91=93=E5=A6=82=E6=B3=95?=
 <algebraicallyClosedField@gmail.com>
Date: Tue, 21 Oct 2025 19:13:00 +0900
Subject: [PATCH 1/3] Add spec to ensure @ in embedded code is not converted to
 Twitter link

---
 spec/tdiary/style/gfm_spec.rb | 26 ++++++++++++++++++++++++++
 1 file changed, 26 insertions(+)

diff --git a/spec/tdiary/style/gfm_spec.rb b/spec/tdiary/style/gfm_spec.rb
index 067a496..1537242 100644
--- a/spec/tdiary/style/gfm_spec.rb
+++ b/spec/tdiary/style/gfm_spec.rb
@@ -626,6 +626,32 @@ def class
 		end
 		it { expect(@diary.to_html).to eq @html }
 	end
+
+	describe 'URLs with @ in an embedding codes must not be converted into Twitter links.
+' do
+		before do
+			source = <<-'EOF'
+# subTitle
+
+This is an embedding of a post of a Mathtodon server.
+
+<iframe src="https://mathtod.online/@Nyoho/115394182617923497/embed" class="mastodon-embed" style="max-width: 100%; border: 0" width="400" allowfullscreen="allowfullscreen"></iframe><script src="https://mathtod.online/embed.js" async="async"></script>
+			EOF
+			@diary.append(source)
+
+			@html = <<-'EOF'
+<div class="section">
+<%=section_enter_proc( Time.at( 1041346800 ) )%>
+<h3><%= subtitle_proc( Time.at( 1041346800 ), "subTitle" ) %></h3>
+<p>This is an embedding of a post of a Mathtodon server.</p>
+<iframe src="https://mathtod.online/@Nyoho/115394182617923497/embed" class="mastodon-embed" style="max-width: 100%; border: 0" width="400" allowfullscreen="allowfullscreen"></iframe><script src="https://mathtod.online/embed.js" async="async"></script>
+<%=section_leave_proc( Time.at( 1041346800 ) )%>
+</div>
+			EOF
+		end
+		it { expect(@diary.to_html).to eq @html }
+	end
+
 end
 
 # Local Variables:

From 0897f82e621b545690f85d8b6fb982bb5291fc8a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E5=8C=97=E4=91=93=E5=A6=82=E6=B3=95?=
 <algebraicallyClosedField@gmail.com>
Date: Tue, 21 Oct 2025 19:18:50 +0900
Subject: [PATCH 2/3] Update spec/tdiary/style/gfm_spec.rb
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

確かに

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---
 spec/tdiary/style/gfm_spec.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/spec/tdiary/style/gfm_spec.rb b/spec/tdiary/style/gfm_spec.rb
index 1537242..68ad78d 100644
--- a/spec/tdiary/style/gfm_spec.rb
+++ b/spec/tdiary/style/gfm_spec.rb
@@ -627,7 +627,7 @@ def class
 		it { expect(@diary.to_html).to eq @html }
 	end
 
-	describe 'URLs with @ in an embedding codes must not be converted into Twitter links.
+	describe 'URLs with @ in embedding codes must not be converted into Twitter links.
 ' do
 		before do
 			source = <<-'EOF'

From 91cbc9564261e32e5d323a0a55177d6e55de9454 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E5=8C=97=E4=91=93=E5=A6=82=E6=B3=95?=
 <algebraicallyClosedField@gmail.com>
Date: Fri, 24 Oct 2025 19:47:02 +0900
Subject: [PATCH 3/3] Stash not only pre and code tags but also iframe and
 script tags

---
 lib/tdiary/style/gfm.rb | 32 ++++++++++++++++++++++++++++++--
 1 file changed, 30 insertions(+), 2 deletions(-)

diff --git a/lib/tdiary/style/gfm.rb b/lib/tdiary/style/gfm.rb
index 023af2a..b211a26 100644
--- a/lib/tdiary/style/gfm.rb
+++ b/lib/tdiary/style/gfm.rb
@@ -65,7 +65,7 @@ def to_html(string)
 				# 2. Apply markdown conversion
 				r = CommonMarker.render_html(r, [:DEFAULT, :UNSAFE], [:autolink, :table])
 
-				# 3. Stash <pre> and <code> tags
+				# 3. Stash <pre>, <code>, <iframe> and <script> tags
 				pre_tag_stashes = []
 				r.gsub!(/<pre(.*?)<\/pre>/m) do |matched|
 					pre_tag_stashes.push(matched)
@@ -78,6 +78,18 @@ def to_html(string)
 					"@@tdiary_style_gfm_code_tag#{code_tag_stashes.length - 1}@@"
 				end
 
+				iframe_tag_stashes = []
+				r.gsub!(/<iframe(.*?)<\/iframe>/m) do |matched|
+					iframe_tag_stashes.push(matched)
+					"@@tdiary_style_gfm_iframe_tag#{iframe_tag_stashes.length - 1}@@"
+				end
+
+				script_tag_stashes = []
+				r.gsub!(/<script(.*?)<\/script>/m) do |matched|
+					script_tag_stashes.push(matched)
+					"@@tdiary_style_gfm_script_tag#{script_tag_stashes.length - 1}@@"
+				end
+
 				# 4. Convert miscellaneous
 				if pre_tag_stashes.none? && code_tag_stashes.none?
 					# STAGE 1: Stash all existing <a> tags from CommonMarker output
@@ -137,7 +149,7 @@ def to_html(string)
 					end
 				}
 
-				# 5. Unstash <pre>, <code> and plugin call
+				# 5. Unstash <pre>, <code>, <iframe> and <script> and plugin call
 				pre_tag_stashes.each.with_index do |str, i|
 					plugin_stashes.each.with_index do |(p_str, p_erb), j|
 						if str["@@tdiary_style_gfm_plugin#{j}@@"]
@@ -154,6 +166,22 @@ def to_html(string)
 					end
 					r["@@tdiary_style_gfm_code_tag#{i}@@"] = str
 				end
+				iframe_tag_stashes.each.with_index do |str, i|
+					plugin_stashes.each.with_index do |(p_str, p_erb), j|
+						if str["@@tdiary_style_gfm_plugin#{j}@@"]
+							str["@@tdiary_style_gfm_plugin#{j}@@"] = CGI.escapeHTML(p_str)
+						end
+					end
+					r["@@tdiary_style_gfm_iframe_tag#{i}@@"] = str
+				end
+				script_tag_stashes.each.with_index do |str, i|
+					plugin_stashes.each.with_index do |(p_str, p_erb), j|
+						if str["@@tdiary_style_gfm_plugin#{j}@@"]
+							str["@@tdiary_style_gfm_plugin#{j}@@"] = CGI.escapeHTML(p_str)
+						end
+					end
+					r["@@tdiary_style_gfm_script_tag#{i}@@"] = str
+				end
 				plugin_stashes.each.with_index do |(str, erb), i|
 					if r["@@tdiary_style_gfm_plugin#{i}@@"]
 						r["@@tdiary_style_gfm_plugin#{i}@@"] = erb